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DETAILED ACTION 

1 . The Action is in response to communication in the form of an RCE filed on October 7, 
2004. 

2. In response to Affidavit 1.131 filed by Applicant, Examiner applies a new art rejection in 
the present office action. 

3. Claims 1 - 22, and 24 are pending examination. 

4. Claim 23 has been cancelled. 

Claim Objections 

Claim 10 is objected to because of the following informalities: grammatical errors. 
Appropriate correction is required. 

Claim Rejections - 35 USC § 102 
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in a patent granted on an application for patent by another filed in the United 
States before the invention thereof by the applicant for patent, or on an international application by another who 
has fulfilled the requirements of paragraphs (1), (2), and (4) of section 371(c) of this title before the invention 
thereof by the applicant for patent. 

The changes made to 35 U.S.C. 102(e) by the American Inventors Protection Act of 1999 
(AIPA) do not apply to the examination of this application as the application being examined 
was not (1) filed on or after November 29, 2000, or (2) voluntarily published under 35 U.S.C. 
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122(b). Therefore, this application is examined under 35 U.S.C. 102(e) prior to the amendment 
by the AIPA (pre-AEPA 35 U.S.C. 102(e)). 

Claims 1-22 and 24 are rejected under 35 U.S.C. 102(e) as being anticipated by 
Jackowski et al (U.S. 6,141,686). 

As per claim 1, Jackowski et al teach a method of tracing data traffic on a network, the 
method comprising: 

- at the transport layer of a protocol stack residing on a first device in the network (column 
9, lines 9-12), detecting a transmission or receipt of data to or from a second device on 
the network (column 4, lines 58-60, interceptor detects transmission or receipt of 
packets); and 

in response to the transmission or receipt being detected, recording the transmission or 
receipt as an entry in a trace log (column 9, lines 3-5, tables of events are stored by 
consolidator; column 5, lines 26-41, send-complete and receive-complete messages are 
stored), wherein the trace log is accessible to determine the volume of data traveling over 
a network (column 5, 55-58; column 11, lines 25-30; column 12, lines 61-67). 

As per claim 2, Jackowski et al teach the method of claim 1, wherein the protocol stack is 
a TCP/IP stack (column 9, lines 9-12). 

As per claim 3, Jackowski et al teach the method of claim 1, wherein the detection step 
further comprises the step of detecting the presence of an input/output packet representing the 
transmission or receipt (column 4, lines 58-60, interceptor detects transmission or receipt). 
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As per claim 4, Jackowski et al teach a method of.tracing a transmission of data over a 
computer network comprising: 

- detecting a transport-layer request to transmit an input/output packet (column 4 5 lines 58- 
60, interceptor detects transmission or receipt of packets); 

- searching the input/output packet to determine an identity of a process that created the 
input/output packet (column 14, lines 27-31; column 10, lines 55-67, the packet is 
analyzed and classified by the application-classifier); and 

- storing in a trace log an entry representing the request, wherein the entry comprises the 
identity of the process, and wherein the trace log is accessible to determine a volume of 
data being transmitted over the network (column 14, lines 27-33; column 11, lines 20- 
28). 

As per claim 5, Jackowski et al teach the method of claim 4, further comprising: 

- detecting an acknowledgment of the transmission (column 5, lines 36-41); and 

- in response to the detection of the acknowledgment, storing in the trace log an entry 
representing the completion of the transmission (column 10, lines 15-22). 

As per claim 6, Jackowski et al teach a method of tracing a receipt of data from a 
computer network comprising: 

- detecting a transport-layer request to transmit a packet for an input/output connection to a 
port (column 4, lines 58-60, interceptor detects transmission or receipt of packets); 
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- searching the packet to determine an identity of a process that created the packet (column 
14, lines 27-31; column 10, lines 55-67, the packet is analyzed and classified by the 
application-classifier); and 

- in response to the detection of a receipt of data at the storing in a trace log an entry 
representing the receipt of the data (column 4, lines 58-60, interceptor detects 
transmission or receipt of packets), wherein the entry comprises the process identification 
(column 10, lines 55-67), and wherein the trace log is accessible to determine a volume 
of the data being transmitted over the network (column 5, 55-58; column 11, lines 25-30; 
column 12, lines 61-67). 

As per claim 7, Jackowski et al teach the method of claim 6, further comprising: 

- creating a connection object representing the opening of the port connection by the 
process (column 11, lines 20-28; column 12, lines 44-60); 

- copying the process identification from the connection object into a transport control 
block associated with the port (column 11, lines 20-28; column 12, lines 44-60); and 

- in response to the detection of data at the port, copying the process identification into the 
trace log (column 11, lines 20-28; column 12, lines 44-60). 

As per claim 8, Jackowski et al teach the method of claim 7, further comprising: copying 
the process identification from the connection object into the transport control block so that the 
process identification is contiguous with the rest of the data in the transport control block 
(column 10, lines 55-67). 
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As per claim 9, Jackowski et al teach the method of claim 8, further comprising: 
detecting the presence of an input/output request packet indicating that the data receipt is 
complete (column 5, lines 36-41; column 10, lines 15-22); and 
in response to the detection of the completion input/output request packet, making an 
entry representing the receipt of the data into the trace log (column 5, lines 36-41 ; column 
10, lines 15-22). 

As per claim 10, Jackowski et al teach a facility for tracing data traffic on a network, the 
facility comprising: 

- an identifying means for identifying a process causing a transport-layer request to 
transmit data via the network (column 10, lines 55-67); and 

a logging means in communication with the identifying means for logging the event, 
wherein the event comprises the identification of the process (column 5, lines 44-47) and 
wherein the logging means is useable to determine a volume of data traveling over the 
network (column 5, lines 55-58). 

As per claim 11, Jackowski et al teach the apparatus of claim 10 wherein the identifying 
means further comprises means for communicating with a transport layer of a protocol stack 
(column 9, lines 9-12). 

As per claim 12, Jackowski et al teach a computer-readable medium having stored 
thereon computer-executable instructions for performing steps comprising: 
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- at the transport layer of a protocol stack residing on a first device in the network (column 
9, lines 9-12), detecting a transmission or receipt of data to or from a second device on 
the network (column 4, lines 58-60, interceptor detects transmission or receipt of 
packets); and 

- in response to the transmission or receipt being detected, recording the transmission or 
receipt as an entry in a trace log (column 9, lines 3-5, tables of events are stored by 
consolidator; column 5, lines 26-41, send-complete and receive-complete messages are 
stored), wherein the trace log is accessible to determine the volume of data traveling over 
a network (column 5, 55-58; column 1 1, lines 25-30; column 12, lines 61-67).. 

As per claim 13, Jackowski et al teach the computer-readable medium of claim 12, 
wherein the protocol stack is a TCP/IP stack (column 9, lines 9-12). 

As per claim 14, Jackowski et al teach the computer-readable medium of claim 12, 
having further computer executable instructions for performing the step of detecting the presence 
of an input/output packet representing the transmission or receipt (column 4, lines 58-60, 
interceptor detects transmission or receipt). 

As per claim 15, Jackowski et al teach a computer-readable medium having stored 
thereon computer-executable instructions for performing steps comprising: 

- detecting a transport-layer request to transmit an input/output packet (column 4, lines 58- 
60, interceptor detects transmission or receipt of packets); 
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searching the input/output packet to determine an identity of a process that created the 
input/output packet (column 14, lines 27-31; column 10, lines 55-67, the packet is 
analyzed and classified by the application-classifier); and 

storing in a trace log an entry representing the request, wherein the entry comprises the 
identity of the process, and wherein the trace log is accessible to determine a volume of 
data being transmitted over the network (column 14, lines 27-33; column 11, lines 20- 
28).. 

As per claim 16, Jackowski et al teach the computer-readable medium of claim 15, 
having further computer executable instructions for performing the step of detecting the presence 
of the input/output packet at the transport layer of a protocol stack (column 4, lines 58-60, 
interceptor detects transmission or receipt of packets). 

As per claim 17, Jackowski et al teach the computer-readable medium of claim 15, 
having further computer executable instructions for performing the step of 

- detecting an acknowledgment of the transmission (column 5, lines 36-41); and 

- in response to the detection of the acknowledgment, storing in the trace log an entry 
representing the completion of the transmission (column 10, lines 15-22). 

As per claim 18, Jackowski et al teach a computer-readable medium having stored 
thereon computer-executable instructions for performing the steps comprising: 
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- detecting a transport layer request to transmit a packet for an input-output connection to a 
port (column 4, lines 58-60, interceptor detects transmission or receipt of packets);; 
searching the packet to determine an identity of a process that created the: packet 
(column 14, lines 27-31; column 10, lines 55-67, the packet is analyzed and classified by 
the application-classifier); and 

- in response to the detection of a receipt of data at the storing in a trace log an entry 
representing the receipt of the data (column 4, lines 58-60, interceptor detects 
transmission or receipt of packets), wherein the entry comprises the process identification 
(column 10, lines 55-67), and wherein the trace log is accessible to determine a volume 
of the data being transmitted over the network (column 5, 55-58; column 11, lines 25-30; 
column 12, lines 61-67). 

As per claim 19, Jackowski et al teach the computer-readable medium of claim 18, 
having further computer executable instructions for performing the steps of: 

creating a connection object representing the opening of the port connection by the 
process (column 11, lines 20-28; column 12, lines 44-60); 

copying the process identification from the connection object into a transport control 
block associated with the port (column 11, lines 20-28; column 12, lines 44-60); and 
in response to the detection of the receipt of data at the port, copying the process 
identification into the trace log (column 11, lines 20-28; column 12, lines 44-60). 
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As per claim 20, Jackowski et al teach the computer-readable medium of claim 18, 
having further computer executable instructions for performing the step of copying the process 
identification from the connection object into the transport control block so that the process 
identification,, is contiguous with the rest of the data in the transport control block (column 10, 
lines 55-67). 

As per claim 21, Jackowski et al teach the computer-readable medium of claim 18, 
having further computer executable instructions for performing the steps of: 

- detecting the presence of an input/output request packet indicating that the data receipt is 
complete (column 5, lines 36-41); and 

- in response to the detection of the completion input/output request packet, storing in the 
trace log an entry representing the receipt of the data (column 10, lines 15-22). 

As per claim 22, Jackowski et al teach the method of claim 1, wherein the transmission of 
data is recorded at the completion of the transmission indicated by an acknowledgement from the 
first device (column 5, lines 36-41; column 10, lines 15-22). 



As per claim 24, Jackowski et al teach the method of claim 4, wherein the entity, of the 
process includes a port number or an IP address relating to the transmission (column 5, lines 51- 
54). 
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Conclusion 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Shabana Qureshi whose telephone number is (571) 272-3990. 
The examiner can normally be reached on Monday - Thursday, 9:30 am to 6:30 pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Hosain T. Alam can be reached on (571) 272-3978. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 



Shabana Qureshi 
Examiner 
Art Unit 2155 



February 3, 2005 
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